@oondemand/oon-core-back 0.7.6 → 0.7.8

package/README.md

@@ -97,3 +97,34 @@ O Core omite todo o corpo de entrada e resposta no `requestLog` para esse métod
 ## Segredos V1 (0.7.6)
 
 `capabilities.secrets.put/status/use/remove` armazena objetos cifrados para Apps single_tenant dedicados. Declare `core.secrets` e `capabilitySettings["core.secrets"]={enabled:true}`. Rotas exigem permissão e sensitiveBody; use `req.accessContext`. Chave provisionada fora do banco, preservada em republicações. Veja o guia distribuído `SECRETS.md` para assinaturas, limites e recadastro explícito.
+
+
+### Aceite de convite (C2, SDK 0.7.7)
+
+`PUBLIC_APP_URL` deve conter a origem pública HTTPS do aplicativo, sem credenciais,
+query, fragmento ou subcaminho. HTTP é permitido apenas em loopback fora de produção.
+A configuração é validada antes de emitir/rotacionar o convite; o header Host não
+é usado como destino. Novos links usam `/accept-invite#token=...`.
+
+O frontend consulta `POST /core/invitations/inspect` com `{ token }`. Somente um
+convite pendente válido permite consultar a existência da identidade. O aceite
+usa `POST /core/invitations/accept` com `{ token, intent, password? }`:
+`authenticate` verifica a senha atual; `register` cria uma identidade com senha
+nova; `session` exige uma sessão válida do destinatário. Nenhum desses caminhos
+redefine a senha de uma identidade existente. Recuperação de senha continua no
+login da plataforma. O retorno após aceite é local e fixo, sem aceitar redirect
+arbitrário. Os endpoints antigos continuam disponíveis até o cutover coordenado.
+
+Provedores locais devem fornecer `auth.inspectInvitation({ req, invitation })`,
+retornando `{ accountExists: boolean, sessionUser?: { id, email } | null }`, além de
+`auth.provisionInvitation`. A sessão opcional deve ser validada como identidade
+(assinatura, expiração, versão de credencial e escopo), sem exigir o acesso que
+o convite ainda concederá. Uma sessão inválida retorna `sessionUser: null`.
+O provisionamento recebe também `intent` e deve verificar a prova correspondente,
+retornando `usuario` com `id` e `email` do destinatário. Sem hook de inspeção,
+um provedor local falha fechado e nunca delega identidades administrativas ao
+provedor de aplicativos.
+
+Publicar primeiro o suporte da Central (consulta e prova de identidade), depois
+lançar front/back do SDK juntos e atualizar consumidores. O bloqueio de integração
+comercial permanece até C3a/C3b; C2 não executa cutover nem reenvia convites.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/api/access.routes.js

@@ -22,9 +22,10 @@ const {
   recoverPendingInvitation,
   assertNotLastAdmin,
 } = require("../core/rbac/storage");
-const { provisionInvitation } = require("../core/rbac/identityProvider");
+const { provisionInvitation, inspectInvitation } = require("../core/rbac/identityProvider");
 
 const router = express.Router();
+router.use(require("../core/rbac/centralInvitations").createRouter({ inviteUrl }));
 
 function requiredRbac() {
   if (!policy().enabled) {
@@ -36,10 +37,16 @@ function requiredRbac() {
 }
 
 function inviteUrl(req, token) {
-  const base = String(
-    process.env.PUBLIC_APP_URL || `${req.protocol || "http"}://${req.get("host") || req.headers.host}`,
-  ).replace(/\/$/, "");
-  return `${base}/accept-invite?token=${encodeURIComponent(token)}`;
+  let base;
+  try {
+    base = new URL(String(process.env.PUBLIC_APP_URL || ""));
+    const local = ["localhost", "127.0.0.1", "[::1]"].includes(base.hostname);
+    if ((base.protocol !== "https:" && !(base.protocol === "http:" && local && process.env.NODE_ENV !== "production"))
+      || base.username || base.password || base.search || base.hash || base.pathname !== "/") throw new Error();
+  } catch {
+    throw new GenericError("Configure PUBLIC_APP_URL com a origem HTTPS pública deste aplicativo.", { statusCode: 503, code: "INVITATION_PUBLIC_URL_INVALID" });
+  }
+  return `${base.origin}/accept-invite#token=${encodeURIComponent(token)}`;
 }
 
 function invitationView(invitation) {
@@ -139,6 +146,7 @@ router.post(
   asyncHandler(async (req, res) => {
     requiredRbac();
     const role = assertAssignable(req.usuario, req.body?.roleCode);
+    inviteUrl(req, ""); // Validate configuration before creating or rotating a token.
     const result = await createInvitation({
       email: req.body?.email,
       name: req.body?.name,
@@ -192,6 +200,7 @@ router.post(
     const previous = await Invitation.findOne({ _id: req.params.id, appCode: appCode() });
     if (!previous) throw new GenericError("Convite não encontrado.", { statusCode: 404 });
     assertAssignable(req.usuario, previous.roleCode);
+    inviteUrl(req, ""); // Validate configuration before creating or rotating a token.
     const result = await createInvitation({
       email: previous.email,
       name: previous.name,
@@ -277,11 +286,9 @@ router.patch(
   }),
 );
 
-router.get(
-  "/invitations/:token",
-  asyncHandler(async (req, res) => {
+const inspectHandler = asyncHandler(async (req, res) => {
     requiredRbac();
-    const invitation = await findInvitationByToken(req.params.token);
+    const invitation = await findInvitationByToken(req.params.token || req.body?.token);
     if (!invitation || invitation.status !== "pending") {
       throw new GenericError("Convite inválido, expirado ou já utilizado.", {
         statusCode: 410,
@@ -289,8 +296,12 @@ router.get(
       });
     }
     res.set("Cache-Control", "no-store");
+    const identity = await inspectInvitation({ req, invitation });
+    if (typeof identity?.accountExists !== "boolean") throw new GenericError("Resposta inválida do provedor de identidade.", { statusCode: 502 });
     res.json({
       invitation: {
+        accountExists: identity.accountExists,
+        sessionUser: identity.sessionUser || null,
         email: invitation.email,
         name: invitation.name,
         roleCode: invitation.roleCode,
@@ -298,19 +309,23 @@ router.get(
         expiresAt: invitation.expiresAt,
       },
     });
-  }),
-);
+  });
+router.get("/invitations/:token", inspectHandler);
+router.post("/invitations/inspect", inspectHandler);
 
-router.post(
-  "/invitations/:token/accept",
-  asyncHandler(async (req, res) => {
+const acceptHandler = asyncHandler(async (req, res) => {
     requiredRbac();
     const password = String(req.body?.password || "");
-    if (password.length < 8) {
-      throw new GenericError("A nova senha deve possuir pelo menos 8 caracteres.", { statusCode: 422 });
+    const intent = req.body?.intent;
+    if (intent !== undefined && !["register", "authenticate", "session"].includes(intent)) {
+      throw new GenericError("Forma de autenticação inválida.", { statusCode: 422 });
+    }
+    if ((intent === "register" || intent === undefined) && password.length < 8) {
+      throw new GenericError("A senha de cadastro deve possuir pelo menos 8 caracteres.", { statusCode: 422 });
     }
+    if (intent !== "session" && !password) throw new GenericError("Informe a senha.", { statusCode: 422 });
 
-    const invitation = await findInvitationByToken(req.params.token);
+    const invitation = await findInvitationByToken(req.params.token || req.body?.token);
     if (!invitation || invitation.status !== "pending") {
       throw new GenericError("Convite inválido, expirado ou já utilizado.", {
         statusCode: 410,
@@ -324,8 +339,12 @@ router.post(
       throw new GenericError("O acesso associado ao convite não está mais disponível.", { statusCode: 410 });
     }
 
-    const identity = await provisionInvitation({ req, invitation, password });
+    const identity = await provisionInvitation({ req, invitation, password, intent });
     const providerUser = identity?.usuario || identity?.user || identity;
+    if (!providerUser?.email || String(providerUser.email).trim().toLowerCase() !== invitation.email.toLowerCase()
+      || !(providerUser.id || providerUser._id)) {
+      throw new GenericError("Identidade retornada não corresponde ao convite.", { statusCode: 502, code: "INVITATION_IDENTITY_MISMATCH" });
+    }
     access.identityId = String(providerUser?.id || providerUser?._id || access.identityId || "") || undefined;
     access.name = providerUser?.nome || providerUser?.name || access.name;
     access.status = "active";
@@ -347,11 +366,12 @@ router.post(
 
     res.set("Cache-Control", "no-store");
     res.json({
-      message: "Convite aceito. A nova senha foi definida e o acesso está ativo.",
+      message: "Convite aceito. O acesso está ativo.",
       email: access.email,
     });
-  }),
-);
+  });
+router.post("/invitations/:token/accept", acceptHandler);
+router.post("/invitations/accept", acceptHandler);
 
 module.exports = router;
 module.exports.inviteUrl = inviteUrl;

package/src/core/middlewares/auth.js

@@ -137,6 +137,14 @@ async function applyEffectiveAccess(usuario) {
       rbacMode: "app-commercial", commercialAccess: { ...authority,
         roleComplete: !local.includes("*") && local.every(p => permissions.includes(p)) } };
   }
+  if (usuario?.canonicalAccess && typeof ctx.config.auth?.verifyToken !== "function") {
+    const source = usuario.canonicalAccess;
+    const role = roleByCode(source.roleCode);
+    if (!source.grantId || source.tenantId !== usuario.tenantId || !role) {
+      throw Object.assign(Error("Concessão central inválida."), { statusCode: 403, code: "CENTRAL_ACCESS_INVALID" });
+    }
+    return { ...usuario, roleCode: role.code, permissions: rolePermissions(role), accessStatus: "active", mustChangePassword: false, rbacMode: "central-invitation" };
+  }
   const access = await resolveUserAccess(usuario);
   return {
     ...usuario,

package/src/core/middlewares/requestLog.js

@@ -8,10 +8,11 @@ const registry = require("../registry");
 const requestLog = async (req, res, next) => {
   if (req.method === "GET") return next();
 
-  const sensitiveBody = await registry.isSensitiveRequest(req.method, req.url || req.originalUrl);
+  const invitationRequest = /\/(?:core\/invitations|convites)\//.test(String(req.originalUrl || req.url));
+  const sensitiveBody = invitationRequest || await registry.isSensitiveRequest(req.method, req.url || req.originalUrl);
   const log = new Log({
     usuario: req.usuario || null,
-    endpoint: req.originalUrl,
+    endpoint: invitationRequest ? String(req.originalUrl).replace(/(\/core\/invitations\/)[^/?]+/, "$1[redacted]").split("?")[0] : req.originalUrl,
     metodo: req.method,
     ip: req.ip || req.headers["x-forwarded-for"] || req.connection?.remoteAddress,
     correlationId: req.correlationId,

package/src/core/rbac/centralInvitations.js

@@ -0,0 +1,70 @@
+"use strict";
+const express = require("express");
+const ctx = require("../context");
+const auth = require("../middlewares/auth");
+const { asyncHandler } = require("../utils/helpers");
+const GenericError = require("../errors/GenericError");
+const { defaultProviderCall } = require("./identityProvider");
+const { models, appCode, audit } = require("./storage");
+const base = "/integracao/autenticacao-aplicativos/convites/v1";
+function enabled() { return process.env.OON_CENTRAL_INVITATIONS_ENABLED === "true" && typeof ctx.config.auth?.provisionInvitation !== "function" && typeof ctx.config.auth?.verifyToken !== "function" && process.env.OON_RUNTIME_MODE !== "local"; }
+async function cutover() {
+  // No import or token recovery. Idempotent state transition touches only old pending invitations.
+  const { Invitation } = models();
+  const session = await Invitation.db.startSession();
+  try { await session.withTransaction(async () => {
+    const rows = await Invitation.find({ appCode: appCode(), status: "pending" }).session(session);
+    for (const row of rows) {
+      const changed = await Invitation.updateOne({ _id: row._id, status: "pending" }, { $set: { status: "revoked", revokedAt: new Date() } }, { session });
+      if (changed.modifiedCount) await audit("invitation.cutover.v1", { actor: "system:cutover", target: row.email, context: { invitationId: String(row._id), cutoverId: "central-invitations-v1" }, session });
+    }
+  }); } finally { await session.endSession(); }
+}
+function createRouter({ inviteUrl }) {
+  const router = express.Router();
+  router.use((req, _res, next) => enabled() ? next() : next("router"));
+  const call = (req, payload) => defaultProviderCall(req, `${base}/command`, payload);
+  const management = handler => [auth, asyncHandler(async (req, res) => { await call(req, { command: "list" }); await cutover(); res.set("Cache-Control", "no-store"); await handler(req, res); })];
+  function identifier(value) {
+    const match = /^central:([a-f\d]{24})$/i.exec(String(value));
+    if (!match) throw new GenericError("Convite anterior ao corte. Solicite um novo convite.", { statusCode: 410, code: "INVITATION_LEGACY_DISABLED" });
+    return match[1];
+  }
+  function invitation(row) { return { ...row, id: `central:${row.id}` }; }
+  const access = row => ({ id: `central:${row.id}`, email: row.email, name: row.name, roleCode: row.roleCode, status: row.status === "accepted" ? "active" : row.status === "pending" ? "invited" : "revoked", origin: "central", invitation: invitation(row) });
+  async function withLink(req, result) {
+    if (result.invitation.status && result.invitation.status !== "pending") return { invitation: invitation(result.invitation), access: access(result.invitation) };
+    const copied = await call(req, { command: "copy", id: result.invitation.id });
+    return { invitation: invitation(copied.invitation), access: access(copied.invitation), inviteUrl: inviteUrl(req, copied.token) };
+  }
+  router.get("/users", ...management(async (req, res) => {
+    const result = await call(req, { command: "list" });
+    const canonical = result.invitations.map(access);
+    const identities = new Set(canonical.map(row => row.email));
+    const local = req.usuario?.commercialAccess ? [] : await models().UserAccess.find({ appCode: appCode(), status: { $ne: "invited" } }).lean();
+    res.json({ results: [...canonical, ...local.filter(row => !identities.has(row.email)).map(row => ({ id: String(row._id), email: row.email, name: row.name, roleCode: row.roleCode, status: row.status, origin: "local" }))] });
+  }));
+  router.post("/users/invitations", ...management(async (req, res) => {
+    inviteUrl(req, "");
+    const result = await call(req, { command: "create", email: req.body?.email, roleCode: req.body?.roleCode, version: 0 });
+    res.status(201).json(await withLink(req, result));
+  }));
+  router.get("/users/invitations/:id/link", ...management(async (req, res) => res.json(await withLink(req, { invitation: { id: identifier(req.params.id) } }))));
+  router.post("/users/invitations/:id/regenerate", ...management(async (req, res) => {
+    inviteUrl(req, "");
+    res.json(await withLink(req, await call(req, { command: "reissue", id: identifier(req.params.id), version: req.body?.version })));
+  }));
+  router.delete("/users/invitations/:id", ...management(async (req, res) => res.json(await call(req, { command: "revoke", id: identifier(req.params.id), version: req.body?.version }))));
+  router.patch("/users/:id", auth, asyncHandler(async (req, _res, next) => { if (!String(req.params.id).startsWith("central:")) return next("router"); throw new GenericError("Gerencie a concessão na Central; esta lista é uma projeção de leitura.", { statusCode: 409, code: "CENTRAL_ACCESS_COMMAND_REQUIRED" }); }));
+  for (const action of ["inspect", "accept", "decline"]) router.post(`/invitations/${action}`, asyncHandler(async (req, res) => {
+    if (!String(req.body?.token || "").startsWith("c3.")) throw new GenericError("Convite anterior ao corte. Solicite um novo convite.", { statusCode: 410, code: "INVITATION_LEGACY_DISABLED" });
+    res.set("Cache-Control", "no-store");
+    if (action === "inspect") return res.json(await defaultProviderCall(req, `${base}/inspect`, { token: req.body.token }));
+    const result = await call(req, { command: action, token: req.body.token, version: req.body.version, intent: req.body.intent, password: req.body.password, registration: req.body.registration });
+    res.json({ ...result, message: "Convite processado pela Central." });
+  }));
+  router.all("/invitations/:token/accept", (_req, res) => res.status(410).json({ code: "INVITATION_LEGACY_DISABLED", message: "Solicite um novo convite." }));
+  router.get("/invitations/:token", (_req, res) => res.status(410).json({ code: "INVITATION_LEGACY_DISABLED", message: "Solicite um novo convite." }));
+  return router;
+}
+module.exports = { enabled, cutover, createRouter };

package/src/core/rbac/identityProvider.js

@@ -10,6 +10,7 @@ const {
 } = require("../utils/instanceActivation");
 
 const IDENTITY_PATHS = Object.freeze({
+  inspectInvitation: "/integracao/autenticacao-aplicativos/convites/inspecionar",
   provisionInvitation: "/integracao/autenticacao-aplicativos/convites/provisionar",
   changeFirstAccessPassword: "/integracao/autenticacao-aplicativos/primeiro-acesso/senha",
 });
@@ -25,6 +26,9 @@ async function defaultProviderCall(req, path, payload) {
 
   try {
     const headers = instanceHeaders(instance);
+    for (const key of ["idempotency-key", "x-correlation-id", "x-oon-tenant-id"]) {
+      if (req?.headers?.[key]) headers[key] = req.headers[key];
+    }
     if (req?.headers?.authorization) headers.Authorization = req.headers.authorization;
     const response = await providerPost(req, path, payload, headers);
     return response.data;
@@ -38,14 +42,24 @@ async function defaultProviderCall(req, path, payload) {
   }
 }
 
-async function provisionInvitation({ req, invitation, password }) {
+async function inspectInvitation({ req, invitation }) {
+  const hook = ctx.config.auth?.inspectInvitation;
+  if (typeof hook === "function") return hook({ req, invitation });
+  if (typeof ctx.config.auth?.provisionInvitation === "function") {
+    throw new GenericError("O provedor local precisa disponibilizar a consulta de convite.", { statusCode: 503, code: "INVITATION_INSPECTION_REQUIRED" });
+  }
+  return defaultProviderCall(req, IDENTITY_PATHS.inspectInvitation, { email: invitation.email });
+}
+
+async function provisionInvitation({ req, invitation, password, intent }) {
   const hook = ctx.config.auth?.provisionInvitation;
-  if (typeof hook === "function") return hook({ req, invitation, password });
+  if (typeof hook === "function") return hook({ req, invitation, password, intent });
   return defaultProviderCall(req, IDENTITY_PATHS.provisionInvitation, {
     email: invitation.email,
     nome: invitation.name,
     roleCode: invitation.roleCode,
     password,
+    intent,
     invitationFingerprint: invitation.tokenFingerprint,
   });
 }
@@ -63,6 +77,7 @@ async function changeFirstAccessPassword({ req, user, password }) {
 module.exports = {
   IDENTITY_PATHS,
   defaultProviderCall,
+  inspectInvitation,
   provisionInvitation,
   changeFirstAccessPassword,
 };

package/src/core/rbac/storage.js

@@ -105,10 +105,10 @@ function sanitizeSnapshot(value) {
   return plain;
 }
 
-async function audit(event, { actor, target, before, after, context } = {}) {
+async function audit(event, { actor, target, before, after, context, session } = {}) {
   if (mongoose.connection.readyState !== 1) return null;
   const { Audit } = models();
-  return Audit.create({
+  const data = {
     appCode: appCode(),
     event,
     actor: typeof actor === "string" ? actor : actorKey(actor),
@@ -117,7 +117,8 @@ async function audit(event, { actor, target, before, after, context } = {}) {
     after: sanitizeSnapshot(after),
     context,
     at: new Date(),
-  });
+  };
+  return session ? (await Audit.create([data], { session }))[0] : Audit.create(data);
 }
 
 function accessError(message, code = "RBAC_ACCESS_DENIED", statusCode = 403) {